ci: harden GitHub Actions workflows

.github/dependabot.yml

@@ -0,0 +1,27 @@
+version: 2
+
+updates:
+  - package-ecosystem: github-actions
+    directory: "/"
+    groups:
+      github-actions:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      default-days: 7
+
+  - package-ecosystem: gomod
+    directory: "/"
+    groups:
+      go-dependencies:
+        patterns:
+          - "*"
+    schedule:
+      interval: weekly
+    cooldown:
+      semver-major-days: 7
+      semver-minor-days: 3
+      semver-patch-days: 2
+      default-days: 7

.github/workflows/ci.yml

@@ -1,8 +1,6 @@
 name: Go
 
-permissions:
-  contents: read
-  pull-requests: write
+permissions: {}
 
 on:
   push:
@@ -12,12 +10,16 @@ on:
 
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      with:
+        persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0
       with:
         go-version-file: go.mod
 
@@ -40,3 +42,22 @@ jobs:
 
     - name: Lint
       run: make lint
+
+  lint-actions:
+    name: GitHub Actions audit
+    permissions:
+      contents: read
+    runs-on: ubuntu-latest
+
+    steps:
+    - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      with:
+        persist-credentials: false
+
+    - name: Run actionlint
+      uses: rhysd/actionlint@393031adb9afb225ee52ae2ccd7a5af5525e03e8 # v1.7.11
+
+    - name: Run zizmor
+      uses: zizmorcore/zizmor-action@71321a20a9ded102f6e9ce5718a2fcec2c4f70d8 # v0.5.2
+      with:
+        advanced-security: false

.github/workflows/release.yml

@@ -1,20 +1,23 @@
 name: Release
 
-permissions:
-  contents: write
+permissions: {}
 
 on:
   push:
     tags: [ "v*" ]
 
 jobs:
   release:
+    permissions:
+      contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
+      with:
+        persist-credentials: false
 
     - name: Set up Go
-      uses: actions/setup-go@v5
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5.6.0 # zizmor: ignore[cache-poisoning] -- cache is branch-isolated; fork PRs cannot write to this cache
       with:
         go-version-file: go.mod
 

Makefile

@@ -1,4 +1,4 @@
-.PHONY: build test integration lint coverage dist test-release
+.PHONY: build test integration lint lint-actions coverage dist test-release
 
 PLATFORMS = linux darwin
 ARCHITECTURES = amd64 arm64
@@ -27,6 +27,10 @@ integration:
 lint:
 	golangci-lint run
 
+lint-actions:
+	actionlint
+	zizmor .
+
 coverage:
 	go test -coverprofile=coverage.out ./internal/...
 	go tool cover -html=coverage.out